Leveraging synthetic traffic data samples for flow classifier training

Abstract

In one embodiment, a device in a network receives traffic data regarding a plurality of observed traffic flows. The device maps one or more characteristics of the observed traffic flows from the traffic data to traffic characteristics associated with a targeted deployment environment. The device generates synthetic traffic data based on the mapped traffic characteristics associated with the targeted deployment environment. The device trains a machine learning-based traffic classifier using the synthetic traffic data.

What is claimed is: 
     
       1. A method comprising:
 receiving, at a device in a network, traffic data regarding a plurality of observed traffic flows; 
 determining, by the device, one or more environment parameters associated with a targeted deployment environment in which a machine learning-based traffic classifier is to be deployed, wherein the targeted deployment environment is different than the network in which the traffic data was received; 
 modifying, by the device, one or more samples of the plurality of observed traffic flows from the traffic data to match traffic characteristics of the targeted deployment environment based on the one or more environment parameters associated with the targeted deployment environment; 
 creating, by the device, synthetic traffic data that resembles actual traffic data expected in the targeted deployment environment based on the one or more modified samples, wherein the synthetic traffic data is not actually observed in the network; and 
 training, by the device, the machine learning-based traffic classifier using the synthetic traffic data for deployment in the targeted deployment environment. 
 
     
     
       2. The method as in  claim 1 , wherein the machine learning-based traffic classifier is configured to classify a particular traffic flow as benign or malware-related. 
     
     
       3. The method as in  claim 1 , wherein the machine learning-based traffic classifier is configured to determine an application associated with a particular traffic flow. 
     
     
       4. The method as in  claim 1 , further comprising:
 after training the machine learning-based traffic classifier using the synthetic traffic data, deploying, by the device, the machine learning-based traffic classifier to the targeted deployment environment. 
 
     
     
       5. The method as in  claim 1 , wherein the machine learning-based traffic classifier is further trained using one or more characteristics of the plurality of observed traffic flows. 
     
     
       6. The method as in  claim 1 , further comprising:
 determining, by the device, a configuration of at least one device used in the targeted deployment environment based on the one or more environment parameters associated with the targeted deployment environment; and 
 modifying, by the device, the one or more samples of the plurality of observed traffic flows from the traffic data in accordance with the configuration of the at least one device used in the targeted deployment environment. 
 
     
     
       7. The method as in  claim 1 , wherein at least one of the one or more modified samples corresponds to at least one of: an advertised security extension, a proxy-related header field, packet length information, inter-packet timing information, or a Hypertext Transfer Protocol (HTTP) header field. 
     
     
       8. The method as in  claim 1 , wherein the plurality of observed traffic flows were generated in a sandbox testing environment. 
     
     
       9. The method as in  claim 1 , wherein the received traffic data is labeled according to a desired set of output labels for the machine learning-based traffic classifier, and wherein the creating of the synthetic traffic data comprises:
 labeling, by the device, the synthetic traffic data using the desired set of output labels. 
 
     
     
       10. An apparatus, comprising:
 one or more network interfaces to communicate with a network; 
 a processor coupled to the one or more network interfaces and configured to execute one or more processes; and 
 a memory configured to store a process executable by the processor, the process when executed operable to:
 receive traffic data regarding a plurality of observed traffic flows in the network; 
 determine one or more environment parameters associated with a targeted deployment environment in which a machine learning-based traffic classifier is to be deployed, wherein the targeted deployment environment is different than the network in which the traffic data was received; 
 modify one or more samples of the plurality of observed traffic flows from the traffic data to match traffic characteristics of the targeted deployment environment based on the one or more environment parameters associated with the targeted deployment environment; 
 create synthetic traffic data that resembles actual traffic data expected in the targeted deployment environment based on the one or more modified samples, wherein the synthetic traffic data is not actually observed in the network; and 
 train the machine learning-based traffic classifier using the synthetic traffic data for deployment in the targeted deployment environment. 
 
 
     
     
       11. The apparatus as in  claim 10 , wherein the machine learning-based traffic classifier is configured to classify a particular traffic flow as benign or malware-related. 
     
     
       12. The apparatus as in  claim 10 , wherein the machine learning-based traffic classifier is configured to determine an application associated with a particular traffic flow. 
     
     
       13. The apparatus as in  claim 10 , wherein, after training the machine learning-based traffic classifier using the synthetic traffic data, the process when executed is further operable to:
 deploy the machine learning-based traffic classifier to the targeted deployment environment. 
 
     
     
       14. The apparatus as in  claim 10 , wherein the machine learning-based traffic classifier is further trained using one or more characteristics of the plurality of observed traffic flows. 
     
     
       15. The apparatus as in  claim 10 , wherein the process when executed is further operable to:
 determine a configuration of at least one device used in the targeted deployment environment based on the one or more environment parameters associated with the targeted deployment environment; and 
 modify the one or more samples of the plurality of observed traffic flows from the traffic data in accordance with the configuration of the at least one device used in the targeted deployment environment. 
 
     
     
       16. The apparatus as in  claim 10 , wherein at least one of the one or more modified samples corresponds to at least one of: an advertised security extension, a proxy-related header field, packet length information, inter-packet timing information, or a Hypertext Transfer Protocol (HTTP) header field. 
     
     
       17. The apparatus as in  claim 10 , wherein the observed traffic flows were generated in a sandbox testing environment. 
     
     
       18. The apparatus as in  claim 10 , wherein the received traffic data is labeled according to a desired set of output labels for the machine learning-based traffic classifier, and wherein the synthetic traffic data is created by:
 labeling the synthetic traffic data using the desired set of output labels. 
 
     
     
       19. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:
 receiving, at the device, traffic data regarding a plurality of observed traffic flows; 
 determining, by the device, one or more environment parameters associated with a targeted deployment environment in which a machine learning-based traffic classifier is to be deployed, wherein the targeted deployment environment is different than the network in which the traffic data was received; 
 modifying, by the device, one or more samples of the plurality of observed traffic flows from the traffic data to match traffic characteristics of the targeted deployment environment based on the one or more environment parameters associated with the targeted deployment environment; 
 creating, by the device, synthetic traffic data that resembles actual traffic data expected in the targeted deployment environment based on the one or more modified samples, wherein the synthetic traffic data is not actually observed in the network; and 
 training, by the device, the machine learning-based traffic classifier using the synthetic traffic data for deployment in the targeted deployment environment. 
 
     
     
       20. The computer-readable medium as in  claim 19 , wherein the machine learning-based traffic classifier is configured to classify a particular traffic flow as benign or malware-related.